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REMARKS 

I. General 

Claims 1-22, 24-28 and 30-44 were pending in the present application. The present 
Office Action (mailed July 24, 2009) raises the following issues: 

• Claims 1-22, 24-28, and 30-44 are rejected under 35 U.S.C. §112, first paragraph; 

• Claims 1-21 and 37-41 are rejected under 35 U.S.C. §101 as being directed to 
non-statutory subject matter; 

• Claims 1-22, 24-28, and 30-44 are provisionally rejected on the ground of 
nonstatutory obviousness-type double patenting over claims 1-36 of co-ending 
application serial no. 10/726,423; 

• Claims 1, 2, 4-6, 8-10, 13, 14, 16, 17, 19-22, 24. 26-28, 38, 40, and 44 are rejected 
under 35 U.S.C. § 103(a) as being unpatentable over U.S. Patent Application 
Publication No. 2004/0199765 to Kohane et al. (hereinafter "Kohane" in view of 
U.S. Patent No. 6,363,486 to Knapton, III (hereinafter "Knapton"); 

• Claims 30-33, 37, 39, and 41-43 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Kohane in view of Knapton and further in view of U.S. Patent 
Application Publication No. 2003/0074564 to Peterson (hereinafter "Peterson"); 

• Claims 3, 7, 1 8, and 25 are rejected under 35 U.S.C. §103 (a) as being 
unpatentable over Kohane in view of Knapton and further in view of U.S. Patent 
No. 6,789,195 to Prihoda (hereinafter "Prihoda"); 

• Claims 11, 12, and 15 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Kohane in view of Knapton and further in view of U.S. Patent Application 
Publication No. 2004/0068650 to Resnitzky (hereinafter "Resnitzky"); 
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• Claim 34 is rejected under 35 U.S.C. §1 03(a) as being unpatentable over Kohane 
in view of Knapton and further in view of Peterson and Prihoda; and 

• Claims 35 and 36 are rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Kohane in view of Knapton and further in view of Peterson and Resnitzky. 

Applicant respectfully traverses the outstanding rejections raised in the current Office 
Action, and requests reconsideration and withdrawal thereof in light of the amendments and 
remarks presented herein. 

II. AiRencimcEts 

Claims 1, 16, and 37 are amended herein. 

Claim 1 is amended to specify that the datastore is "residing on a data storage device". 
No new matter is introduced by this amendment as support can be found at least at paragraphs 
0018-0019 of the specification. This amendment is intended to overcome the issue raised in the 
current Office Action regarding the recited datastore, and is believe to ensure that claim 1 is 
properly directed lo statutory subject matter by tying it to a machine. 

Claim 16 is amended to recite "wherein said key organization system comprises a 
processor-based computer". No new matter is introduced by this amendment as support can be 
found at least at paragraphs 0018-0019 of the specification. This amendment is intended to 
overcome the issue raised in the current Office Action regarding the recited key organization 
system, and is believe to ensure that claim 16 is properly directed to statutory subject matter by 
tying it to a machine. 

Dependent claim 37 is similarly amended to recite "wherein said key organization system 
comprises a processor-based computer". 
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III. Rejections Under 35 U.S.C. §112, First Paragraph 

Claims 1-22. 24-28, and 30-44 are rejected under 35 U.S.C. §1 12, first paragraph. The 
Office Action contends that the claims contain subject matter which was not sufficiently 
described in the specification. However, the only limitation which the Office Action expressly 
identifies as allegedly not sufficiently described in the specification is "wherein input of the 
second-level access key by said medical service provider is not required", see page 2 of the 
Office Action. Applicant respectfully notes that this limitation (or a similar limitation) is recited 
only in claims 30, 39, 41, and 43. Thus, the Office Action fails to establish any basis or provide 
any reasoning as to why the others of claims 1-22, 24-28, and 30-44 stand rejected under 35 
U.S.C. § 1 12, first paragraph. Further, as discussed below, Applicant respectfully contends that 
the recited limitation of claims 30-39, 41, and 43 is fully supported by the specification so as to 
reasonably convey to one of ordinary skill in the art that the inventor(s) had possession of the 
claimed invention at the time the application was filed. 

The specification clearly describes exemplary embodiments in which a medical service 
provider is not required to input an access key that grants access to a patient's corresponding 
medical records. Rather, an exemplary key management system is described which associates 
access keys with a medical service provider for whom the keys have been granted, and then 
when the medical service provider logs in to the key management system, the medical service 
provider is presented with a list of patients who have granted the medical service provider an 
access key. The medical service provider ma}' then access a patient's medical records by 
selecting the patient from the list, wherein a record processing module of the system uses the 
corresponding access key that the patient granted the medical service provider (rather than 
requiring the medical service provider to input such access key) for controlling the access rights 
by the medical service provider to the patient's medical records. For instance, paragraphs 0035- 
0037 of the specification explain an exemplary embodiment as follows: 

[0035] ... Typically, medical service provider 18 logs into key 
organization system 10 using an encrypted SSL (i.e., secure sockets layer) 

connection. 
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[0036] Referring also to FIG. 6, when accessing key organization system 
10, record processing module 58 provides the medical service provider 1 8 with a 
rendered screen display 158 that includes a list of patient identifiers 160. Patient 
identifiers 160 define the particular patient(s) who provided access keys to 
medical sendee provider 18 (i.e., granting medical service provider 18 access to 
various portions of their medical record(s)).... 

[0037] The presence of each of these names in the list of patient 
identifiers 1 60 indicates that a key was received from that patient. In order to 
access the medical record of a patient for which the medical service provider has 
an access key (i.e., for one of the patients listed in the list of patient identifiers 
160), the medical service provider 18 selects the appropriate identifier using a 
mouse pointer 162 (or some other pointing device, not shown). For example, if 
the medical sen ice d idj j rjted to access the medical record of Timothy 
Smith (i.e., patient 22), medical service provider 1 8 would typically double click 

fusing a mo uv > 1 < si_u w in^ ntifier 164 associated w ith i'i moiln Smith. 

Record pn ^s -i w , Jule 58 would then, in turn, use access key 14 to access 
(i.e., retrieve, decrypt, and display) medical record 62, the medical record of 
Timothy Smith, i.e., patient 22. (Emphasis added). 

Clearly, at least the above portion of the specification describes an exemplary 
embodiment in which a medical service provider is not required to input an access key that 
controls access rights for a patient's medical records, but instead a record processing module 
(58) uses the access key that is associated with the medical service provider for a patient selected 
by the medical service provider (without requiring the medical service provider himself/herself 
to enter the access key - instead, the medical service provider is described in the above example 
as simply selecting the patient whose medical records the medical service provider desires to 
access (e.g., by double clicking on the corresponding patient identifier). 

Thus, for at least this reason, the rejection under 35 U.S.C. §112, first paragraph should 
be withdrawn. 
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IV. Rejections Under 35 U.S.C. §101 

Claims 1-21 and 37-41 are rejected under 35 U.S.C. §101 as being directed to non- 
statutory subject matter. 

Claim 1 is amended herein to recite that the datastore is "residing on a data storage 
device". This is believed to resolve the issue raised by the current Office Action regarding the 
datastore, and is believed to ensure that claim 1 is directed to proper statutory subject matter 
because it is tied to a machine (i.e., the data storage device). As such, the rejection of claim 1 
and the claims depending therefrom should be withdrawn. 

Independent claim 16 is amended herein to recite "wherein said key organization system 
comprises a processor-based computer". This is believed to resolve the issue raised by the 
current Office Action regarding the recited key organization system, and is believed to ensure 
that claim 16 is directed to proper statutory subject matter because it is tied to a machine (i.e., the 
processor-based computer). As such, the rejection of claim 16 and the claims depending 
therefrom should be withdrawn. 
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V. Provisional Nonstatutory Obviousness-type Double Patenting Rejections 

Claims 1 -22, 24-28, and 30-44 are provisionally rejected on the ground of nonstatutory 
obviousness-type double patenting over claims 1-36 of co-ending application serial no. 
10/726,423 (hereafter "the '423 application"). Applicant respectfully submits that the rejection 
should be withdrawn to allow the present application to advance to allowance for the reasons 
discussed below. 

First, it appears that because the provisional double patenting rejection should be the only 
issue remaining in the present application (as all other rejections are believed to be traversed for 
the reasons presented herein), the provisional double patenting rejection should be withdrawn to 
allow the present application to issue without requiring a terminal disclaimer. For instance. 
M.P.E.P. §804(I)(B)(1) explains: 

If a "provisional" nonstatutory obviousness-type double patenting (ODP) 
rejetcion is the only rejection remaining in the earlier filed of the two pending 
applications, while the later-filed application is rejectable on other grounds, the 
examiner should withdraw that rejection and permit the earlier-filed application to 
issue as a patent without a terminal disclaimer. 

Here, the present application is the earlier-filed application, having a filing date of 
December 3, 2003, while the '423 application has a filing date of March 9, 2004. Therefore, it 
appears that the Examiner should withdraw the provisional obviousness-type double patenting 
rejection for the present application, and allow any such obviousness-type double patenting 
issues that may persist in the claims of the '423 application to be resolved during prosecution of 
that application. 

In addition, Applicant notes that the Examiner has failed to establish a prima facie case to 
support the ground of obviousness-type double patenting. An obviousness-type double patenting 
rejection should make clear the differences between the inventions defined by the conflicting 
claims. Importantly, the rejection should also explain the reasons why a person of ordinary skill 
in the art would conclude that the invention defined in the claim at issue would have been an 
obvious variation of the invention defined in a claim in the patent. M.P.E.P. § 804(II)(B)(1). 
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In this case, Applicant respectfully points out that the Examiner has not articulated 
sufficient reasoning why a person of ordinary skill in the art would conclude that the pending 
claims are an obvious variation of the claims of the '423 application. See the Office Action of 
July 24, 2009 at pgs. 5-7. While the Office Action makes conclusory statements that certain 
limitations of the claims of the present application are "equivalent" to certain limitations in the 
claims of the '423 application, the Office Action offers no explanation or support as to why the 
claims of the present application, when read as a whole, are believed to be an obvious variant 
from the claims of the '423 application. As one example, claim 1 of the present application 
recites "generating a second-level access key by the patient modifying the level of access of the 
first-level access key", and the Office Action does not identify any claim in the '423 application 
that recites (or renders obvious) modifying the level of access of a first-level access key for 
generating a second-level access key. Therefore, the Examiner has not properly established a 
prima facie case of obviousness-type double patenting for the present application. 

For the reasons above, Applicant respectfully requests that the rejection of claims 1-22, 
24-28, and 30-44 be withdrawn to allow the present application to advance to allowance. 
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VI. Rejections Under 35 U.S.C. §103 

A. Rejections under 35 U.S.C. §103 over Kohane in view of Knapton 

Claims 1. 2, 4-6, 8-10, 13, 14, 16, 17, 19-22, 24 5 26-28, 38, 40, and 44 are rejected under 
35 U.S.C. § 1 03(a) as being unpatentable over Kohane" in view of Knapton. 

Independent Claim 1 

Claim 1 recites in part "maintaining, in a datastore residing on a data storage device a 
first-level access key that grants, to a medical service provider, a level of access to a set of 
medical records of a patient; . . . and generating a second-level access key by the patient 
modifying the level of access of the first-level access key". The Office Action cites (on page 8 
thereof) to Fig. 2B of Kohane as disclosing the recited datastore, and thus appears to contend that 
the credentials (39) of Kohane constitute the recited first-level access key. The Office Action 
concedes (at page 8 thereof) that Kohane fails to teach or suggest generating a second-level key 
by modifying the level of access of the first-level key. However, the Office Action introduces 
Knapton and contends that Knapton discloses this limitation. Applicant respectfully disagrees 
for the reasons discussed below. 

Knapton discloses (in its abstract): 

Controlling the usage of a software component by an application program 
in an end user computer system includes obtaining an identifier of the application 
program by a controller computer system and generating a first password from the 
received application program identifier and an identifier of the component. The 
component, the component's identifier and the first password are communicated 
to the end user computer system. The component is registered with the application 
program as a "snap-in" or "plug-in" component. The application program 
generates a second password from the application program identifier and the 
received component identifier, compares the first password and the second 
password, and allows use of the "snapped-in" component by the application 
program on the end user computer system when the first password matches the 
second password. 

The Office Action cites to col. 2, lines 24-43 of Knapton, which provide: 
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An embodiment of the present invention is a method of generating a 
password for controlling usage of a software component by an application 
program. A first key is created from an identifier of the application program, a 
second key is created from an identifier of the component, and the password is 
created from the first and second keys. 

Another embodiment of the present invention is a method of controlling 
the usage of a software component with an application program in a computer 
system. The method includes obtaining an identifier of the application program 
and generating a first password from the application program identifier and an 
identifier of the component. The method also includes registering the component 
with the application program, generating, by the application program, a second 
password from the application program identifier and the component identifier, 
comparing the first password and the second password; and allowing use of the 
component with the application program on the computer system when the first 
password matches the second password. 

It appears that Knapton does not address access keys that grant a medical service provider 
a level of access to a set of medical records of a patient. Instead, Knapton merely addresses 
passwords that control use of software components by an application program. 

Further, Knapton does not generate a second-level access key (or password) by 
modifying the level of access of a first-level access key (or password). Knapton mentions 
generating a password from a first key created from an identifier of the application program and 
from a second key that is created from an identifier of the component. If the password is deemed 
an "access key", it is not generated by modifying a level of access of another password. In 
addition, neither of the first key and second key appear to correspond to any level of access, but 
instead appear to be based on an identifier of an application program and software component. 

Knapton further mentions generating a first password from the application program 
identifier and an identifier of the component, and generating a second password from the 
application program identifier and the component identifier. While this mentions generating a 
first and second password, it does not teach or suggest generating the second password by 
modifying the level of access of the first password. Instead, both the first and second passwords 
are generated in Knapton from the application program identifier and component identifier. 



21 



Application No. 10/726,952 



Docket No.: 66729/P033US/1 06 14705 



In view of the above, the applied combination of Kohane and Knapton fails to teach or 
suggest all limitations of claim 1, and therefore the rejection of claim 1 should be withdrawn. 

Independent Claim 1 6 

Independent claim 16 recites in part "generating, by the key organization system, a 
second-level access key by modifying the level of access of the first-level access key. said 
second-level access key granting, to a second medical service provider, a second level of access 
to the set of medical records of the patient". The applied combination of Kohane and Knapton 
fails to teach or suggest at least this limitation for reasons similar to those discussed above with 
claim 1. Therefore, the rejection of claim 16 should likewise be withdrawn. 

Independent Claim 22 

Independent claim 22 recites in part "generate a second-level access key by modifying 
the level of access of the first-level access key". The applied combination of Kohane and 
Knapton fails to teach or suggest at least this limitation for reasons similar to those discussed 
above with claim 1. Therefore, the rejection of claim 22 should likewise be withdrawn. 

Dependent Claims 

Each of dependent claims 2, 4-6, 8-10, 13, 14, 17, 19-21, 24, 26-28, 38, 40, and 44 
depends either directly or indirectly from one of independent claims 1,16, and 22, and thus each 
inherits all limitations of the respective independent claim from which it depends. It is 
respectfully submitted that dependent claims 2, 4-6, 8-10, 13, 14, 17, 19-21, 24, 26-28, 38, 40, 
and 44 are allowable not only because of their dependency from their respective independent 
claim for the reasons discussed above, but also in view of their novel claim features (which both 
narrow the scope of the particular claims and compels a broader interpretation of their respective 
independent claim). 
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B. Rejections under 35 U.S.C. §103 over Kohane in view of Knap ton and Peterson 

Claims 30-33, 37, 39, and 41-43 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Kohane in view of Knapton and further in view of Peterson. Applicant 
respectfully disagrees for the reasons discussed below. 

huk p endent Claim 30 

Claim 30 recites in part "receive, via said communication network, a request from said 
medical service provider to access the set of medical records of the patient; and responsive to 
said received request, use sai ic \ el access ke\ u u i 

the modified level of access to the set of medical records of the patient, wherein input of the 
second- lc\ t \ access e g} by said medical service provider is not required " (emphasis added). 

The Office Action concedes that the combination of Kohane and Knapton fails to teach or 
suggest "wherein input of the second-level access key by said medical service provider is not 
required", see page 17 of the Office Action. However, the Office Action contends that Peterson 
discloses this limitation, and concludes that it would have been obvious to modify the teachings 
ol' Peierso ithii ilu combi on stem ol' Kohane and Knapton "to facilitate access in the 
event of emergency or urgent care situation." See pages 17-18 of the Office Action. 

Peterson discloses a system in which either of two access keys may be used for accessing 
a patient's medical data. "Privacy is assured because no one can access the records without a 
'key' or unique identifier, which are known only to the patient, and are not discoverable with 
knowledge of patient's name, social security number, telephone number or other national]} 
indexed information." Peterson, f 0010. Peterson further describes such a key or unique 
identifier at paragraph 0012 as follows: 

An individual is assigned an identifier, which may be printed on a card or 
otherwise carried on the individual's person. The individual chooses a second, 
memorable, unique identifier for use when the card is not available. Entering 
either identifier provides immediate access to the records. No password is needed 
for viewing of the records, thereby facilitating access in the event of an 
emergency .... 
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Thus, Peterson describes that either of the two access keys or unique identifiers assigned 
to the patient must be input in order to access the patient's medical records, but viewing access 
does not further require a password. Peterson describes in paragraph 001 1 that: "Altering and 
updating the information requires use of a personal identifier plus a password, which is selected 
by the individual." Therefore, viewing of the medical records requires only input of one of the 
two access keys assigned to the patient, while editing of the medical records further requires 
input of a password in Peterson. In no event does Peterson not require a medical service 
provider to input an access key (e.g., unique identifier) for accessing the patient's medical 
records, see e.g., paragraph 0010 of Peterson ("Privacy is assured because no one can access the 
records without a 'key' or unique identifier"). 

Claim 30 recites that a second-level access key is used for granting the medical service 
provider a modified level of access to the set of medical records, where input of such second- 
level access key by the medical service provider is not required. The Examiner contends that the 
credentials of table 22 of Kohane (as allegedly modified according to Knapton) constitute the 
recited second-level access key. If the system of Peterson were employed within Kohane, the 
credentials would include at least the access key (unique identifier) required to be entered by the 
medical service provider by Peterson. 

Further, if neither the access key (unique identifier) nor the password of Peterson were 
required to be entered by the medical service personnel, then it appeai-s that unrestricted access 
would be available to the patient's medical records. In that Instance, the recitation by claim 30 
of " use sun sec 1 -level access key for granting said medical service provider the modified 

level of an ^ i - ] ' l w cords of the patient" (emphasis added) w ould not be 

satisfied because no second-level access key would be used. 

Thus, for at least the above reasons, the applied combination of Kohane, Knapton, and 
Peterson fails to teach or suggest all limitations of claim 30. Therefore, the rejection of claim 30 
should be w ithdrawn. Further, each of dependent claims 31-33 depends either directly or 
indirectly from claim 30, and are thus believed to be allowable at least for the reasons discussed 
above with claim 30. 
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Further claims 37 and 39 depends either directly or indirectly from independent claim 1, 
and are thus believed allowable at least for the reasons discussed above for claim 1 . 

Claim 41 depends from claim 16, and is thus believed to be allowable at least for the 
reasons discussed above with claim 16. 

Claims 42-43 each depends either directly or indirectly from independent claim 22, and 
are thus believed to be allowable at least for the reasons discussed above with claim 22. 

C. Rejections under 35 U.S.C. §103 over Kohane in view of Knapton and Prihoda 

Claims 3, 7, 18, and 25 are rejected under 35 U.S.C. §103 (a) as being unpatentable over 
Kohane in view ol' Knapton and further in view of Prihoda. These dependent claims are 
believed to be allowable at least based on their dependency from their respective independent 
claim for the reasons discussed above. 

D. Rejections under 35 U.S.C. §103 over Kohane in view of Knapton and Resnitzky 

Claims 11,12, and 15 are rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Kohane in view of Knapton and further in \ iew of Resnitzky. These dependent claims arc 
believed to be allowable at least based on their dependency from their respective independent 
claim for the reasons discussed above. 

E. Rejection under 35 U.S.C. §103 over Kohane in view of Knapton, Peterson, and 

Prihoda 

Claim 34 is rejected under 35 U.S.C. § 103(a) as being unpatentable over Kohane in view 
of Knapton and further in view of Peterson and Prihoda. This dependent claim is believed to be 
allowable at least based on its dependency from its respective independent claim for the reasons 

discussed above. 
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F. Rejection under 35 U.S.C. §103 over Kohane in view of Knapton, Peterson, and 

Resnitzky 

Claims 35 and 36 are rejected under 35 U.S.C. §103 (a) as being unpatentable over 
Kohane in view of Knapton and further in view of Peterson and Resnitzky. These dependent 
claims are believed to be allowable at least based on their dependency from their respective 
independent claim for the reasons discussed above. 

VII, Coi:ivj 

In view of the above, Applicant believes the pending application is in condition for 
allowance. 

Applicant believes no fee is due with this response. However, if an additional fee is due, 
please charge our Deposit Account No. 50-3948, under Order No. 66729/P033US/10614705 
from which the undersigned is authorized to draw. 

Dated: October 26, 2009 Respectfully submitted, 
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FULBRIGHT & JAWORSKI L.L.P. 
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Dallas, Texas 75201-2784 
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(214) 855-8200 (Fax) 
Attorney for Applicant 
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